How To Improve Safety On A Train

Transcription

1 Paper Presented at the International Rail Safety Conference, Perth October A CASE STUDY OF SYSTEMIC FAILURE IN RAIL SAFETY: THE WATERFALL ACCIDENT Kent Donaldson, ITSRR NSW & Dr Graham Edkins, DOI Victoria Abstract The Waterfall railway accident occurred on 31 January 2003 and was one of the most tragic accidents in Australian railway history resulting in the loss of seven lives. This paper describes the circumstances leading to the accident as well as two concurrent inquiries launched immediately following the event. Firstly, the Ministry of Transport s (MOT) rail safety investigation is outlined, and the subsequent identification of contributing factors including; inadequate medical standards to detect a pre-existing health problem with the driver; the poor functionality of the deadman device as a defence against driver incapacitation; and inadequate training of the guard to be an effective human defence. Secondly, the Special Commission of Inquiry s (SCOI) Review 1 of the Safety Management Systems of RailCorp and the effectiveness of the New South Wales Rail Safety Regulator (ITSRR) to oversee safety is described. This broad ranging review was one of the most extensive safety examinations ever conducted on a railway system within Australia. The objectives, methodology and findings of the SCOI review are outlined and implications for rail organisations and regulators are discussed. The need for integrated safety management systems, the up skilling and continuous professional development of regulators and industry in safety science and human factors, and the importance of proactive risk management practices are identified in the paper. Finally, a summary of current national safety initiatives that are being progressively implemented post Waterfall is provided. Introduction This paper consists of two parts; the first part describes the Ministry of Transport (MOT) investigation into the circumstances of the Waterfall accident; and the second part details a Safety Management Systems review of RailCorp and the New South Wales Independent Transport Safety and Reliability Regulator (ITSRR), conducted on behalf of the Special Commission of Inquiry (SCOI). Part 1: Ministry of Transport (MOT) Investigation The MOT initiated an investigation into the 31 January 2003 fatal derailment at Waterfall under the Rail Safety Act The investigation was conducted according to Australian Standard AS , Guidelines for Railway Safety Investigation. The objective of the investigation was to determine the circumstances surrounding the accident and to recommend corrective actions that, if implemented, would minimise the risk of similar events occurring. Terms of Reference were established to inquire into: 1 Part 2 of this paper draws heavily from the SCOI report, Safety Management Systems review of RailCorp and the NSW Independent Transport Safety and Reliability Regulator (ITSRR). A copy of the full report, dated 6 July 2004, can be obtained by contacting the SCOI at

2 Paper Presented at the International Rail Safety Conference, Perth October The causes of the railway accident at Waterfall on 31 January 2003 and the factors that contributed to it 2. The adequacy of the safety management systems applicable to the circumstances of the railway accident The investigation examined the following areas: 1. Rolling Stock 2. Infrastructure 3. Human Factors In addition, extensive work was done on modeling the derailment and train crash sequence via simulation techniques. The adequacy of the post accident emergency response was also examined. The investigation team used a combination of officers from the Rail Safety Regulator, NSW Police, the State Rail Authority (SRA), the Rail Infrastructure Corporation (RIC) and expert consultants in human factors, occupational medicine and safety management systems. Overview of accident At approximately 0714 on 31 January 2003, State Rail Authority (SRA) passenger train service C311, a scheduled service from Sydney to Port Kembla, overturned at high speed and collided with stanchions and a rockcutting approximately 2 km south of Waterfall NSW. The electric train was carrying 47 passengers and two crew. As a result of the accident, the driver and six passengers were killed. The four-car Tangara train, identified as G7, was extensively damaged. The investigation found there was a high probability that the driver became incapacitated at the controls as a result of a pre-existing medical condition, shortly after departing Waterfall Station. The train then continued to accelerate, out of control, with maximum power applied. The deadman system and the guard were the designated risk controls against driver incapacitation. Both controls failed to intervene as intended and C311 overturned on a curve while travelling at approximately 117 km/h. The train continued on its side for a short distance until it collided with stanchions and a rock cutting. The first and second carriages were righted by the collision. The driver and six passengers were ejected from the train as a result of the accident. Significant factors The immediate cause of the accident was the train exceeding the overturning speed for the curve. The systemic causes of the accident were the simultaneous failures of risk controls in the areas of medical standards, deadman system and training.

3 Paper Presented at the International Rail Safety Conference, Perth October Although G7 was fitted with two data loggers, they had not been commissioned. Extensive investigation was therefore required, including computer simulation, to provide an understanding of the conditions that preceded the accident and the crash sequence. An underdeveloped safety culture had resulted in failures in the application of the published SRA Safety Management System by line management. SRA had insufficient safety and risk management expertise and had not systematically identified hazards to its operations or effectively controlled all the risks that had been identified. It relied on accident trends to identify risks, rather than evaluating what events might possibly occur so that rare but catastrophic events were not adequately identified under this reactive approach to risk management. The Rail Safety Regulator had been inadequately resourced to develop an effective rail safety regulatory regime, and consequently had not identified and/or acted on the risk management deficiencies that existed at SRA. The investigation made a number of performance-based recommendations to address the systemic safety deficiencies identified. Three of the issues most crucial to this actual event were medical standards, the functionality of the deadman device, and the evaluation and training of the human defence (the guard). Medical standards had not been effectively updated over time, and medical practitioners applying tests were not necessarily aware of the matters most significant to the work tasks being undertaken. In particular, they had been led to believe that the existence of deadman devices on electric trains would mean that sudden collapse would not have catastrophic consequences. The deadman system did not detect the driver s collapse because of fundamental design issues. It could be held suppressed either by the master controller handle being held in a twisted position (by hand force) or by a pedal being held depressed in an intermediate position (by foot/leg force). Investigations revealed, however, that heavy people were capable of holding the pedal in the suppressed position purely by their dead weight without any conscious effort, so that if such a person lost consciousness, the deadman device may not activate. This and allied deficiencies had been identified when trains of this type were first placed in service about 15 years previously, and at various subsequent times, but management had failed to act on the warnings. Since no other hardware devices were fitted (in particular, no vigilance control device was in place), the only remaining backup was human in the form of the guard, who could have detected that the train was exceeding the authorised speeds and applied the brakes. However this particular guard was indecisive and possibly unobservant, and had some previous history which may have provided cause for concern as to his ability to manage an emergency. Moreover the training given to guards in assessing emergency conditions was demonstrated to be seriously deficient.

4 Paper Presented at the International Rail Safety Conference, Perth October Recommendations A total of 66 recommendations were made and are summarised below into two sections. The first section covers those related to factors that directly contributed to the accident and the second, to those addressing other system deficiencies that came to light in the course of the investigation. Recommendations related to contributing factors SRA prepare a strategic plan to bridge the gap between existing safety and risk management practices and good practices in these areas. The Rail Safety Regulator mandate medical standards for train crews and other railway safety workers to provide for predictive and preventive management of potentially incapacitating medical conditions, including guidelines in relation to the application of medical standards in the rail industry for use by medical examiners. All accredited operators take immediate action to ensure that no cab-based equipment could be deliberately or inadvertently used to circumvent the deadman system or any other safety device. SRA address as a matter of urgency the latent technical deficiencies identified in the deadman system fitted to the Tangara (and other) trains. The Rail Safety Regulator commission an appropriately funded project to research options available to integrate contemporary technology with existing and developing deadman, vigilance and speed envelope systems. Rail operators ensure that the progressive FAID scores (or the equivalent) for individuals are assessed on both master rosters and actual hours worked, as part of the fatigue management program. In addition, review and, if necessary, update rostering policies to accommodate an acclimatisation period for rail safety workers returning to shift work after an absence or leave. The Rail Safety Regulator collaborate with SRA and other operators to develop a guideline for fatigue management across NSW. SRA commission an independent formal Safety Culture Survey. SRA clearly specify crew responsibilities and expected crew behaviours in emergency situations. SRA expedite the integration of crew concept values and activities into initial and recurrent training programs associated with train drivers and train guards. That auditors of safety critical training be conversant with the principles of contemporary risk management and have access to expertise in training and development. SRA nominate a position to be accountable for developing an integrated certification regime, that will ensure rail safety workers in all categories remain competent and correctly certified. The Rail Safety Regulator investigates performance based rolling stock evacuation procedures and equipment and mandates an appropriate standard for all rail operators. SRA conduct testing to determine if the existing Tangara external Emergency Door Releases will function as intended under all foreseeable conditions.

5 Paper Presented at the International Rail Safety Conference, Perth October Officers of the Rail Safety Regulator, who are involved in accreditation and audit, be trained in Safety Management Systems and Risk Management. The Rail Safety Regulator be provided with all appropriate resources to fulfil its accreditation, audit and investigation responsibilities. Recommendations related to additional findings The Rail Safety Regulator should require all accredited rail organisations in NSW to ensure that any risks associated with configuration changes are managed by the application of a configuration change control process. The Rail Safety Regulator develops an audit function specifically to the staff certification records of operators. RIC should have a continuous program to review the actual position of all speed boards, to ensure consistency with design position. SRA provide the Regulator with a program to appoint an accountable person to review its timetable, using a risk based approach, and eliminate any conditions where the timetable cannot be achieved. The Rail Safety Regulator issue a guideline on the demonstrable competencies required of a rail safety specialist. SRA implement a train operations quality assurance program, based on routine data logger surveillance, which will support training and other programs designed to ensure safe driver behaviour. That emergency procedures within the Rail Management Centre be reviewed and developed to ensure unambiguous and coordinated communication within the Rail Management Centre. Train guards be provided with effective and reliable communications equipment for use in emergencies. The Rail Safety Regulator develop a critical response capability and accident investigation procedures applicable to its role in transport accidents. A Memorandum of Understanding, or other protocol, be developed between the Rail Safety Regulator and the NSW Police regarding rail accident investigation in NSW. The Rail Safety Regulator be appropriately resourced and skilled to fulfil its role. International Implications The findings of the MOT investigation have a number of implications for regulators and rail organisations that spans across international boundaries. Regulators require a robust review of national standards including greater emphasis on safety management systems and risk evaluation. Industry has to come into the 21 st Century in terms of modern management systems and technology application. Design standards require national and international benchmark for passenger and freight operations. Certification of infrastructure, rollingstock and systems need more stringent application by operator and manufacturers.

6 Paper Presented at the International Rail Safety Conference, Perth October Data analysis and research requires causal factors and modern probability methodology to be applied. A simple streamlined approach to safety management systems needs to be rigorously applied by operators. Hazard perception A sense of vigilance and understanding of the integrated safety management system need to be integrated into any railway operation. Risk predictability should be assessed at the design, implementation and change aspects of any safety management. Part 2: Safety Management Systems Review of RailCorp and ITSRR by SCOI Background A Special Commission of Inquiry (SCOI) was convened following the Waterfall rail accident on 31 January 2003, with Terms of Reference to inquire into and report upon to the NSW Governor on the following matters: 1. The causes of the railway accident at Waterfall on 31 January 2003 and factors that contributed to it. 2. The adequacy of the safety management systems applicable to the circumstances of the railway accident. 3. Any safety improvements to rail operations which the Commissioner considers necessary as a result of his findings under matters (1) and (2). An Interim Report addressing the matters contained within the first Term of Reference was presented on 15 January This Interim Report identified a number of safety issues that led to the derailment of the train, and the subsequent loss of seven lives. Many of the issues identified in the SCOI Interim Report are similar to those described in the MOT investigation outlined in Part 1 of this paper. To address the second and third Terms of Reference, the SCOI sought advice from suitably qualified and experienced safety management system experts as to a strategic approach for determining the adequacy of the safety management systems of the relevant rail entities. The SCOI in August 2003 appointed Dr Graham Edkins and Dr Rob Lee, two internationally recognised safety management systems experts, to assist with Stage 2 of the Inquiry. On 24 September 2003, a desktop review of StateRail s safety management system was undertaken by Drs Edkins and Lee. To further assist the Commission with meeting Terms of Reference 2 and 3, Drs Edkins and Lee recommended that a systemic safety review of the Ministry of Transport (MOT), the State Rail Authority (StateRail) and the Rail Infrastructure Corporation (RIC) be conducted. Drs Edkins and Lee further recommended that a Safety Management Systems Expert Panel be created to oversee the work of a team of experienced safety auditors who would conduct the safety review.

7 Paper Presented at the International Rail Safety Conference, Perth October A Safety Management Systems Expert Panel (Expert Panel) of six people with extensive experience of safety management systems, across a wide variety of regulatory and high reliability organisations, was formed in October 2003 to plan and oversee the SMS review to assist the Commissioner in formulating a report on Stage 2 of the Inquiry. In addition, the following resources assisted the expert panel: 1. A suitably qualified 11-person safety review team with recognised expertise in system safety practices and human factors, and with specific experience in conducting audits. To ensure that contemporary knowledge of safety systems management across various high-risk industries was used, it was recommended that candidates be sourced both from within and outside the rail industry. 2. A suitably qualified project manager to coordinate the administrative requirements, including the appointment of the audit team, development of a project plan and maintenance of regular contact with the relevant parties to be reviewed. 3. An internationally recognised safety systems expert with previous experience conducting large-scale audits of rail entities. The role of this expert was to advise the Expert Panel on the most effective approach and methodology to be adopted for the SMS review. The following Terms of Reference for the proposed review were developed: Under the direction of the Expert Panel, the role of the audit team is to comprehensively review the safety management systems applicable to the circumstances of the Waterfall rail accident, and specifically in relation to the relevant parties: 1. Gather documented evidence that the safety system elements are complied with at various operational levels. 2. Determine the adequacy of the safety system elements in comparison to organisations with recognised mature best practice safety systems. 3. Identify specific actions, such as poor documentation, failure to address documented safety concerns, reflective of an immature or non-integrated, safety system that may have contributed to the circumstances surrounding the Waterfall Rail Incident. 4. Identify more recent actions and or initiatives, both prior to and post Waterfall that reflect of their current safety cultures. Challenges faced by the Safety Review Between the period immediately following the Waterfall accident in January 2003 and the commencement of the SCOI system safety review in January 2004, the structure of the NSW rail system had undergone significant change. At the time of the Waterfall accident the

8 Paper Presented at the International Rail Safety Conference, Perth October Sydney metropolitan network was managed and operated by StateRail and Rail Infrastructure Corporation (RIC). When the SCOI safety review commenced, the State government had created RailCorp to reintegrate elements of StateRail and RIC into a single suburban rail entity responsible for rolling stock, operations, infrastructure and maintenance. Therefore, the safety review examined RailCorp and ITSRR at a time when they were both in the initial planing stages of their respective new entities. Because of a still evolving organisational maturity, any findings in respect to StateRail safety management were generally considered applicable to RailCorp. Approach / Methodology of Safety Review From the period 22 January 2004 to 11 March 2004, on behalf of the SCOI, a broad ranging and comprehensive safety review was undertaken of RailCorp and the Independent Transport Safety and Reliability Regulator (ITSRR). The time taken to conduct the review, was approximately 3836 man-hours over a 10-week period involving: The conduct of over 125 interviews within RailCorp The conduct of over 30 interviews within ITSRR The detailed review of over 500 documents. The review resulted in an outcome that extended across many areas and provided detailed findings in several of these areas. This breadth and detail resulted in one of the most searching examinations ever conducted on a railway system within Australia, and perhaps worldwide. The review was unique in that it focused on both the regulator and a railway at the same time. The work of the expert panel was subject to review by three internationally recognised safety experts working in the field of rail, nuclear power and aviation. One of these reviewers, Professor James Reason, noted that the safety systems review: constitutes one of the most exhaustive, detailed and sophisticated examinations of an organisation s safety practices and thinking I have yet seen. Also in reviewing the work of the panel, Dr John Loy, CEO of the Australian Radiation Protection and Nuclear Safety Agency (ARPANSA) stated: the Safety Management Systems Review of RailCorp and ITSRR by the Special Commission s Panel of Experts is a state of the art review that has been carried out by experts with appropriate range of expertise and using best practice methodology effectively. RailCorp The safety review methodology was based on well-established safety audit processes and contemporary methods used within Australia and abroad. Safety management system (SMS) audit methodologies, taken from various high-risk industries such as aviation, petrochemical,

9 Paper Presented at the International Rail Safety Conference, Perth October and transport systems, were reviewed, and their most applicable elements were utilised for the SCOI safety review process. A 29 element safety program tool was developed for the review of RailCorp based on a core 23 element Safety Systems Audit Checklist obtained from Qantas Airways Limited. The 29 elements are shown below in Table 1. Table 1: RailCorp Safety Elements Item Safety Element 1.0 Management Commitment 2.0 Policy and Objectives 3.0 Safety Representative and Personnel 4.0 Safety Committee 5.0 Management Review 6.0 Training and Education 7.0 Hazard Identification and Risk Management 8.0 Document Control 9.0 Record Control 10.0 Internal Audit 11.0 Incident/Accident Reporting System 12.0 Incident/Accident Investigation 13.0 Analysis and Monitoring 14.0 Emergency Response Procedures 15.0 Change Management 16.0 System for Managing Requirements and Changes 17.0 Customer Feedback 18.0 Contracted Goods and Services 19.0 Traceability of Goods and Services 20.0 Measuring Equipment and Calibration System 21.0 Procurement of Goods and Services 22.0 Equipment Maintenance 23.0 Design and Development 24.0 Management and Staff Recruitment** 25.0 Medical Issues** 26.0 Human Factors** 27.0 Safety Organisation** 28.0 Safety Awareness** 29.0 System Safety Program Plan **New element not included in the original Qantas Safety Systems Audit Checklist NOTE: Not all 29 elements were examined and in some cases evidence to assess specific elements was not found. The audit tool was used as a framework to gather information from three key sources: 1. Site Visits;

10 Paper Presented at the International Rail Safety Conference, Perth October Document reviews; and 3. Interviews. In addition, a safety climate survey of RailCorp was undertaken to enable a statistical comparison of the perceptions and attitudes of different categories of employees toward safety. The main part of the survey tool comprised 34 questions on various aspects of safety and was developed based on similar survey tools employed in the transport industry. The RailCorp safety climate survey was undertaken in parallel with the SCOI safety review. The survey was distributed by hand across various locations in the Sydney area, during February and March 2004, to maximise the response rate. Participation in the survey was entirely voluntary. There was a very high level of willingness on the part of RailCorp staff to complete the safety climate survey, which resulted in the completion of 459 surveys from a sample size of 460 ITSRR An audit tool was customised for the safety review of ITSRR and focused on how well the regulator met its statutory obligations of providing safety oversight of SRA and RIC at the time of the Waterfall accident. Additionally, it focused on the adequacy of the regulatory framework to monitor rail safety. The ITSRR safety program elements that made up the audit tool are shown below in Table 2. Table 2: ITSRR Safety Program Elements Item Safety Element 1.0 Regulatory independence 2.0 Regulatory mandate 3.0 Policy and objectives 4.0 Organisation and function 5.0 Document Control and Data analysis 6.0 Transition 7.0 Safety enforcement over rail authority 8.0 ITSRR accident/incident investigation 9.0 ITSRR audits 10.0 Safety accreditation 11.0 Partnership with the rail authority Key Issues Arising from the Safety Review According to modern management principles and practices, to actively manage the safety of a railway system it is essential to have in place both: an integrated safety management system (SMS) to identify, assess and control the wide range of hazards occurring in a highly technical environment; and ongoing strategies and actions to develop, maintain and enhance a positive safety culture.

11 Paper Presented at the International Rail Safety Conference, Perth October While the audit was carried out on RailCorp the audit team was able to identify StateRail specific findings at the time of the accident. For clarity, findings for the historical StateRail are identified separately from today s RailCorp even though StateRail findings can confidently be attributed to RailCorp. StateRail Major deficiencies in StateRail s SMS at the time of the Waterfall accident that may have influenced the causal factors associated with the accident, included: 1. The SMS was ineffective and not fully implemented or integrated. 2. The SMS was missing elements essential to ensure the safe running of a railway including: Requirements assurance in design and development (renewal programs) Management of change System safety engineering 3. Elements that were in place did not give adequate direction and guidance to ensure the safe running of a railway. For example, major deficiencies were identified in: Hazard Identification Risk Assessment Risk Management Training Internal and External Assurance Specific systemic safety issues within StateRail at the time of the Waterfall accident that may have influenced the causal factors associated with the accident include: 1. A poorly defined process for managing requirements of assets, safety validation of procurement contracts and budgetary control for train safety improvement initiatives. 2. No defined process for identifying and managing safety-critical systems and processes. 3. No strategic approach to training within the organisation, including little if any training needs analysis, limited or no identification of critical staff safety competencies, and no organisation-wide effective and systematic process identified for evaluating training. RailCorp The review determined that most day-to-day activities by staff occur without adverse impact upon passengers, equipment or assets. In addition, there was a general willingness of staff to

12 Paper Presented at the International Rail Safety Conference, Perth October acknowledge long standing problems and inefficiencies and to commence a broad range of improvement activities to address these issues. However, the major safety focus throughout RailCorp appears to be on compliance with the NSW Occupational Health & Safety Act and Regulations to the detriment of ensuring a safe outcome for all, and particularly more complex, activities in the organisation. There was little recognition of the critical importance of ensuring that railway equipment and processes are fit for purpose. Consequently, the organisation had not adopted many of the principles and practices employed by other organisations operating in high reliability environments such as airlines, petrochemical companies and major manufacturing organisations. This would involve development of strategies to identify, review and ensuring the management of both high probability, low consequence hazards such as passengers falling in the platform gap, as well as low probability, high consequence hazards such as a high speed train rollover. Throughout RailCorp the following deficiencies were identified: 1. No effective formal performance management system that incorporated measurable safety accountabilities and responsibilities. 2. Inadequately defined safety accountability and responsibilities for senior management. 3. No effective means of reviewing and acting upon audit, investigation and review findings. 4. No effective management information system for managing audit and investigation findings in a closed loop fashion to ensure closure. 5. No effective means for identifying system hazards. 6. No effective system for tracking and reviewing identified safety risks and monitoring the effectiveness of controls. 7. The SMS had a strong bias towards Occupational Health and Safety (OH&S) with very little influence from a proactive system safety engineering approach. 8. Lack of strategic direction with regard to management systems, including safety, due to continual instability and transient nature of senior management positions. 9. Lack of readiness for emergencies due to inadequate system safety analysis, training and poorly defined, implemented and managed policies and plans. 10. RailCorp, like many other railways, has a focus on making and following rules rather than adopting a problem-solving approach by identifying and reviewing hazards. While rules are essential to running an efficient railway system, RailCorp can only become a learning problem-solving organisation once it accepts that to implement an SMS it must be able to transcend a rulebased approach to system safety.

13 Paper Presented at the International Rail Safety Conference, Perth October Underlying the ability to deliver an effective SMS is the quality of the human resources management (HRM) systems. All components of RailCorp s HRM systems must be clearly aligned with the development of an effective SMS. Management reward policies and structures including promotion criteria, selection and recruitment should be aligned with the organisation s stated objectives with respect to risk and safety management. There has been substantial senior management instability with five CEOs and five Corporate Safety Managers since the Glenbrook accident in December This has resulted in a lack of a clearly defined, well articulated and consistent management safety agenda. Without strong, consistent leadership: 1. The organisation became reactive to safety issues rather than identifying and examining hazards proactively and systemically. 2. The organisation was internally focused and did not effectively learn from incidents that occurred in other rail organisations or from safety lessons learned by other high reliability industries. 3. The organisation operated in an industrial environment where the union management became a de facto leadership and was a significant distraction and occasionally an obstacle to management implementing safety improvements. 4. Ideas and concepts for improvement were either suppressed by management or were not even raised for fear of reproach from an uninformed and constant changing senior management. The review also found that StateRail lacked effective leadership on safety matters, and that RailCorp has inherited the same fundamental safety deficiencies. Particular safety deficiencies identified in RailCorp include: 1. Lack of a formal and consistent approach to hazard identification, risk assessment and management. 2. Lack of a formal information system for identifying, assessing and managing safety risk including controls. 3. No formal and consistent approaches to reviewing and ensuring that risk controls are valid and effective. 4. Lack of a formalised approach to change management, and particularly organisational change, to ensure a safe outcome. 5. Inconsistent approach to investigating safety occurrences. 6. Persistence of a blame culture in some elements of the organisation. Regulator - Ministry of Transport

14 Paper Presented at the International Rail Safety Conference, Perth October The review found that some systemic safety issues within the Ministry of Transport at the time of the Waterfall occurrence might have influenced causal factors associated with the accident, specifically: 1. Key individuals within the regulatory body lacked essential qualifications, training and experience in system safety fields such as risk management, human factors and systems engineering. 2. No processes were in place to measure the effectiveness of the regulatory function. 3. There were insufficient key resources to carry out regulatory responsibilities effectively. 4. There were no detailed policy documents and document control processes to ensure consistency in safety accreditation, audit and investigation functions. 5. There was no overarching policy and guidance material to frame regulations under the co-regulatory model and provide guidance to railways. Regulator ITSRR The review acknowledged that there has been significant change since the Waterfall accident starting with the newly created ITSRR, to ensure greater independence from the Ministry of Transport and the creation of a separate Office of Transport Safety Investigation(s) (OTSI). The formation of ITSRR has resulted in a general improvement to key business processes within the regulator and has provided additional resources that will ultimately benefit the NSW rail industry. Positive aspects arising from this review include: 1. There is clearer policy and supporting legislation in regard to enforcement actions and the issuing of sanctions for non-compliance; 2. A confidential reporting system was developed by the previous regulatory regime and continues to be refined and successfully receive reports from the industry; 3. Plans for research and safety analysis functions are being developed; and 4. ITSRR has a new professionally qualified human factors capability. Despite these changes the following factors, if left unattended, will continue to limit the effectiveness of the rail safety regulator in overseeing rail safety: 1. Unfounded confidence in accreditation baselines established by previous regulators. 2. Insufficient qualifications, training and experience in system safety and risk assessment fields. 3. Structural arrangements that give rise to perceived and actual conflicts of interest between resources. 4. Lack of formal and detailed processes to verify compliance with accreditation conditions.

15 Paper Presented at the International Rail Safety Conference, Perth October Implications for Rail Organisations and Regulators The SCOI, at the time of writing this paper, have yet to publish their final report, which is expected to contain a number of recommendations for RailCorp and the Regulator. However, it can be clearly seen that many of the identified issues from the safety review are not confined to the NSW rail environment but are relevant for rail organizations and safety regulators operating in vastly different settings and cultures. The broad ranging and detailed nature of the safety review provides a useful safety health check for the industry in regard to their own safety governance arrangements. The following questions may serve as a prompt or benchmark for both rail organisations and regulators to self examine the suitability and effectiveness of their own systems for ensuring continuous safety systems improvement. Rail Organisations Do you have Integrated Safety Management Systems? The safety function should not operate stand-alone but be a normal part of good business practice. Are Risk Management activities system wide and proactive? Hazard identification should be broad ranging and systems based, and be continually focused on predicting risks to the business. Do you have formal document control processes, particularly for change management activities? Does your organisation have expertise and a requisite understanding of human and organisational factors? This may involve employing or utilizing external expertise in human factors. Human factors expertise or a thorough understanding of the theories of human and organizational behavior does not necessarily come from staff that attend a short course conducted on a one-off basis. A capability within the organization must be developed and maintained. Does your organisation have a program for continued professional development in safety science? Individuals employed in a professional capacity such as lawyers, psychologists and health care professionals need to continually demonstrate evidence of professional development. The same should apply to safety professionals. This does not mean safety managers need to all have post graduate qualifications in safety science, but key individuals responsible for safety strategy need to keep up with good practices and contemporary initiatives in the dynamic field of safety management systems. Is safety culture measured on a periodic basis? Do your employees really believe that there is a just approach to incident/accident investigation? While clearly established policies and procedures advocating a systemic approach to safety investigation is essential, the real test of a good safety culture is whether employees think these policies are actually applied in practice. What evidence could you present that indicates your organisation has a learning culture? Do you have an integrated safety information management system that drives strategy? Is information on organizational and human factors collected from a variety of sources such as investigation, audit, change management, normal operations and other sources, and then integrated to form a complete picture?

16 Paper Presented at the International Rail Safety Conference, Perth October Do you have a human systems integration program that incorporates principles of error tolerance? This may include training operational and management staff in team based human factors competencies, incorporating human factors principles into equipment design or change management projects, or maintaining a just culture approach to investigation and safety reporting. Regulator Is the regulator sufficiently independent and autonomous from government? Is there a function for the independent (from regulator) conduct of safety investigations? Does the regulator have expertise and an ongoing professional development program in human and organisational factors and safety science? How does the regulator ensure that they don t lose touch with current rail industry practices? Does the regulator comprehensively assess the adequacy of safety accreditation and material change applications to ensure that they are rigorous? Does the regulator require industry operators to collect causal factors data to an agreed standard so that emerging safety deficiencies can be identified across various sectors? Does the regulator have sufficient resources to enable compliance and accreditation activities to be effectively achieved? Current National Safety Initiatives Post Waterfall Post Waterfall, a number of safety initiatives have already been implemented or are underway. Table 3 below, presents a list of safety projects by the National Rail Safety Regulators Panel (RSRP) and other agencies, that have not necessarily being initiated as a result of the Waterfall accident, but nevertheless gives some surety that the Australian rail industry has recognised the need to address the safety deficiencies described above. Table 3: National Safety Initiatives Project Development of human factors competencies for rail safety workers Review of deadman and vigilance systems Development of national health assessment standards Management of change guidelines National Rail Safety Accreditation Package (NRSAP) Development of National Rail Safety Database Development of code of practice for safety investigations Development of key safety competencies and professional development program for regulatory staff Development of national communication strategy and information sharing across jurisdictions Rail safety legislation reviews Agency/Group Regulators Panel Various jurisdictions DOI / NTC Regulators Panel NSW / Regulators Panel ATSB / Regulators Panel ARA / DOI Regulators Panel Regulators Panel NTC / Various jurisdictions

17 Paper Presented at the International Rail Safety Conference, Perth October Conclusion This paper has outlined the approach, results and implications of two separate inquiries into the Waterfall accident. Both inquiries have highlighted the importance, for rail organisations, of integrated safety management systems, formal documentation processes, good safety information systems, a proactive approach to risk management and the need for specialist expertise in safety management and human factors. For regulators, independence, adequate resources, expertise in safety science, robust processes for the validation of accreditation and change management applications, were common factors identified. The investigation into the Waterfall accident has consumed much time and many resources, in addition to having a significant impact on individuals, particularly those involved in the accident. However, the authors of this paper sincerely hope that the learning s derived from such a tragic event will have a lasting effect on the rail industry. In the words of Mr Terry Worrall, an Independent Rail Operations and Safety Consultant commenting on the SCOI review: Much of the outcome from the SCOI will be under public scrutiny and rightly so. It would be tragic for such a valuable contribution to rail safety to be diluted and even worse still left on the shelf.